Responsibilities:

Security Operations and Monitoring

• Monitor security alerts, dashboards, and logs across the Microsoft Defender suite (Endpoint, Identity, Cloud Apps, etc.) and Microsoft Purview to detect potential security incidents.

• Manage and optimize Microsoft Defender security policies, configurations, and deployment across the enterprise environment.

• Utilize Microsoft Purview capabilities (e.g., Data Loss Prevention, eDiscovery) to enforce compliance policies and protect sensitive data.

• Develop and maintain custom detection rules and alerts within the security platforms to address emerging threats.

Incident Response and Handling

• Serve as a primary responder for security incidents, with a specific focus on malware, viruses, and other endpoint compromises.

• Perform forensic analysis, containment, eradication, and recovery steps during active incidents.

• Conduct root cause analysis for security incidents and implement necessary corrective and preventive measures.

• Document all incident response activities, findings, and lessons learned to continuously improve the IR process.

Threat Management and Analysis

• Analyze threat intelligence to identify potential risks and vulnerabilities relevant to the organization.

• Proactively hunt for threats across the environment using tools like Microsoft Defender XDR.

• Develop and implement strategies to defend against prevalent malware types (e.g., ransomware, spyware, trojans).

• Stay current with the latest cybersecurity trends, attack techniques, and adversary tactics.

Security Enhancement and Reporting

• Provide regular reports on the organization's security posture, incident metrics, and platform performance.

• Collaborate with IT and other departments to implement security best practices and system hardening across the infrastructure.

• Assist in the development and delivery of cybersecurity awareness training for employees.

Minimum Requirements:

• Bachelor’s degree in Computer Science, Information Technology, Cybersecurity, or a related field, or equivalent practical experience.
• Minimum of 3-5 years of experience in a dedicated cybersecurity role (e.g., Security Analyst, Incident Responder, SOC Analyst).
• Proven, in-depth hands-on experience managing, configuring, and utilizing the Microsoft Defender suite (Defender for Endpoint is critical) and Microsoft Purview (DLP, Information Protection).
• Demonstrated experience in managing the full lifecycle of security incidents, from detection and analysis to containment, eradication, and recovery.
• Strong understanding of current malware and virus infection vectors, persistence mechanisms, and remediation techniques.
• Proficiency in security information and event management (SIEM) tools, vulnerability management, and endpoint detection and response (EDR) principles.

Preferred Skills & Experience:

Relevant certifications (e.g., CompTIA Security+, GIAC GCIH, Microsoft SC-200/SC-400).
Experience with scripting languages (e.g., PowerShell, Python) for automation and analysis.
Familiarity with cloud security principles, particularly within the Azure/Microsoft 365 ecosystem.

117300 - 160000 USD a year